Cybercrime: Cyber Digest CPROC 2018-03-01

Cybercrime Digest Bi-weekly update and global outlook by the Cybercrime Programme Office of the Council of Europe (C-PROC) 1-15 March 2018

Source: Scientific American Date: 1 Mar 2018 Supreme Court Skeptical of Microsoft’s Ireland E-Mail Privacy Claims “Justices are considering whether a law passed prior to the Web and cloud computing allows companies to hide data stored abroad. The Stored Communications Act (SCA) gives law enforcement with a warrant the authority to compel companies to hand over e-mails stored on U.S. soil that are relevant to an investigation. Congress passed that law in 1986, however, before the dawn of the Web and cloud computing. As a result, the legislation’s powers have been limited by the lawmakers’ inability to imagine a time when data could be stored anywhere in the world and accessed easily over a computer network.”

Source: Project Syndicate Date: 8 Mar 2018 How Will New Cybersecurity Norms Develop? “Last month, United Nations Secretary-General António Guterres called for global action to minimize the risk posed by electronic warfare to civilians. Guterres lamented that “there is no regulatory scheme for that type of warfare,” noting that “it is not clear how the Geneva Convention or international humanitarian law applies to it.”. […] Many observers have called for laws and norms to secure this new environment. But developing such standards in the cyber domain faces a number of difficult hurdles. Although Moore’s law about the doubling of computing power every two years means that cyber time moves quickly, human habits, norms, and state practices change more slowly. […] Cyber tools are dual use, fast, cheap, and often deniable, verification and attribution are difficult, and entry barriers are low. Moreover, while the Internet is transnational, the infrastructure (and people) on which it relies fall within the differing jurisdictions of sovereign states. And major states differ in their objectives, with Russia and China stressing the importance of sovereign control, while many democracies press for a more open Internet.”

Source: Le Faso Date: 14 Mar 2018 Répression de la cybercriminalité au Burkina Faso : Un avant-projet de loi en gestation “Le Burkina Faso veut renforcer son arsenal juridique contre la 3e grande menace planétaire, la cybercriminalité. Réunis à Ouagadougou du 12 au 15 mars 2018, à l’appel du ministère de la Justice, des droits humains et de la promotion civique, une vingtaine de spécialistes du domaine informatique, du secteur privé et de la recherche prennent part à l’atelier national d’élaboration d’un avant-projet de loi relatif à la répression de la cybercriminalité. La cérémonie d’ouverture a eu lieu, ce lundi en présence du ministre en charge de la justice René Bagoro, qui avait à ses côtés sa collègue du développement de l’économie numérique et des postes, Hadja Ouattara/Sanon. […] «Cet avant-projet dont nous espérons l’adoption rapide devra nous permettre d’adapter notre législation et ainsi satisfaire à nos obligations internationales, mais aussi de pouvoir demander à adhérer à la convention de Budapest qui est une base de coopération judiciaire entre les pays qui en sont membres en matière de répression de la cybercriminalité», a expliqué le ministre Bagoro.”

Source: Europol Date: 2 Mar 2018 Two arrested in France for major CEO fraud “House searches in France have led to the arrests of two individuals suspected of largescale CEO fraud. The criminals belonged to an organised crime group involved in at least 24 cases of CEO fraud causing EUR 4.6 million worth of damage. With the support of Europol, the French National Gendarmerie carried out the searches in Paris and Lille and made the subsequent arrests on 20 February 2018. The French National Gendarmerie organised an operational meeting in Bordeaux on 14 February where experts and investigators from Belgium, Romania, Israel and Switzerland joined French law enforcement specialists, exchanged their findings and agreed on a mutual action plan for the near future. The investigation was launched in June 2016 when French law enforcement discovered two French companies had fallen victim to CEO fraud, incurring an estimated EUR 1.2 million in losses.”

Source: Europol Date: 2 Mar 2018 Europol’s EU Internet Referral Unit partners with Belgium, France and the Netherlands to tackle online terrorist content “This week Europol’s EU Internet Referral Unit (IRU) launched a pilot project with the Internet Referral Units of Belgium, France and the Netherlands. The project aims to improve the detection, analysis and referral of online terrorist content. The partners involved now benefit from a Europol-hosted centralised platform which improves the speed of detecting terrorist content, streamlining the referral process and standardising the reporting and communication with the Online Service Providers (OSPs). As a result, this platform facilitates cooperation between European law enforcement authorities and OSPs in their shared fight against online terrorism in the context of the EU Internet Forum. The project is developed under Europol’s EU IRU mandate to coordinate and share detection tasks (flagging) of online terrorist content with relevant partners, and to carry out and support referrals quickly, efficiently and effectively in close cooperation with the industry.”

Source: The Japan Times Date: 13 Mar 2018 ICANN meets as internet overseers weigh website owner privacy “The group overseeing internet addresses is scrambling to balance the privacy of website owners and the right to know who is behind online pages. The nonprofit Internet Corporation for Assigned Names and Numbers (ICANN) began a weeklong meeting Monday focused on the fate of the public Whois database, which shows contact information for those who own websites. The General Data Protection Regulation set to take effect in the European Union on May 25 could make revealing personal information about website owners in Whois illegal. […] If ICANN were to simply discontinue the Whois index in Europe, that could create a haven for those from other parts of the world who want to hide which websites they own. […] ICANN is refining a plan to divide Whois into two tiers — one open to the public […] and a second that could be accessed as needed by police, researchers or others with legitimate queries.” READ MORE RELATED ARTICLES ICANN, More Details Published on ICANN-proposed Interim Model, 8 Mar 2018

Source: IMF Blog Date: 13 Mar 2018 IMF addresses the Dark Side of the Crypto World “The same reason crypto-assets—or what some people call crypto-currencies—are so appealing is also what makes them dangerous. These digital offerings are typically built in a decentralized way and without the need for a central bank. This gives crypto-asset transactions an element of anonymity, much like cash transactions. The result is a potentially major new vehicle for money laundering and the financing of terrorism. […] The same innovations that power crypto-assets can also help us regulate them. To put it another way, we can fight fire with fire. Regulatory technology and supervisory technology can help shut criminals out of the crypto world. More broadly, we are seeing crypto-asset exchanges in some countries that are subject to know-yourcustomer requirements. These advances will take years to refine and implement. Two examples highlight the promise of this approach over the long term: Distributed ledger technology; […] Biometrics, artificial intelligence, and cryptography.” READ MORE

Source: FBI Date: 15 Mar 2018 International Criminal Communication Service Dismantled “International organized crime and drug trafficking groups were dealt a blow by the takedown of an encrypted communication service they used to plan and commit their crimes, the FBI and its international partners announced yesterday. Canada-based Phantom Secure was a criminal enterprise that provided secure communications to high-level drug traffickers and other criminal organization leaders. The group purchased smartphones, removed all of the typical functionality—calling, texting, Internet, and GPS—and installed an encrypted e-mail system, so the phones could only communicate with each other. If a customer was arrested, Phantom Secure destroyed the data on that phone, which is obstruction of justice under U.S. law. In an attempt to thwart law enforcement efforts, the company required new customers to have a reference from an existing user. Given the limited functionality of the phones and the fact that they only operate within a closed network of criminals, all of Phantom Secure’s customers are believed to be involved in serious criminal activity.”